stbuehler.de

Creating a blog with nanoc3

Thu, 14 May 2026 17:49:50 +0000

Welcome to the first post on my blog!

nanoc3 is a framework to compile static websites; as only i am modifying the content, there is no need for any dynamic part in it - i can just update the static files when i want to change something.

A static website has some interesting features:

No need for any database setup
No need to run php/python/ruby/perl (or whatever you would use to generate pages) on your webserver, resulting in lower load and faster responses
Less software to maintain on the server which means less security problems.

You can compile dynamic parts too of course, for example i could compile the menu and the design for a page statically and still create the content with php.

This is all nice for a simple web page, you can easily maintain pages about you and your projects, but sometimes you like external input like comments on your page. This is where DISQUS comes in, and i hope it saves me a lot of problems with spam and keeping a “comment software” uptodate :)

nanoc3 generates content items from static files by default, but you can add your own sources too; so i wrote a “blog” source, which creates virtual items like monthly overviews. Perhaps i will publish my nanoc3 helpers sometime in the future :)

DKIM fails at Content-Transfer-Encoding

Thu, 14 May 2026 17:49:50 +0000

DomainKeys Identified Mail (DKIM) is used to prevent people from sending spam mails with “from” mail addresses from your domain; you announce with DNS records that you sign all your mails with a RSA key, and everyone can check whether mails have been really sent by you.

For this it hashes (parts of) the body and some headers, and signs these hashes with the private RSA key; the public RSA key is published with DNS. You can for example see my DKIM public key with the following command:

$ dig TXT stbuehler1._domainkey.stbuehler.de.  ; <<>> DiG 9.7.3 <<>> TXT stbuehler1._domainkey.stbuehler.de. ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38117 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0  ;; QUESTION SECTION: ;stbuehler1._domainkey.stbuehler.de. IN TXT  ;; ANSWER SECTION: stbuehler1._domainkey.stbuehler.de. 86400 IN TXT "v=DKIM1\; g=*\; k=rsa\; p=MIG fMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDiuq2TzvQJZU3QRkAwrOxGid4aamyykI8y/+LrIhE0j4 yxHOBi2EQQ8UN/oYsrLHuzTe3bC83r/ir5nm3r1Zp+u+0hIBGYUSmektWA/YEJnEFWcqOl80F0arid9 m+pcdvJ4u0rygZDggaNppI5X6g2ZE45gdxmTTF5Z3boqigFDwIDAQAB"

There are some problems with mailing lists (they often modify body and headers, especially the subject), but you can solve these problems by not signing the subject and signing only the initial part of the body; as this system is about preventing spam, the cryptographic requirements are not that high (you should use GPG for everything else).

But recently i stumbled across another serious issue; a friend had some problems with his DKIM setup, where he was able to successfuly verify DKIM signatures from most people, but it failed for one. The log showed it failed verifying the body hash, and so it was clear that something was messing with the body.
After some test mails i saw something suspicious: mails which i got with “Content-Transfer-Encoding: 8bit” would fail for him (but succeed for me), and he got them as “Content-Transfer-Encoding: quoted-printable”. So his mail server didn’t accept 8bit mails, and the origin mail server would change the encoding to quoted-printable, thus modifying the body, and not recalculate the DKIM signature; my mail server did accept the 8bit encoding, so it worked for me.
The reason the setup works with most people is that nearly no one uses 8bit encoding…

So, we found the problem, but whose fault is it?

It turns out the DKIM rfc says you SHOULD always convert your messages to 7bit / quoted-printable encodings…

This basically makes 8bit, which was introduced to save bandwidth when you send (binary) attachments, completely unusable with DKIM.

Imho the body should have been hashed after reverting the content-transfer-encoding, so recoding with a different encoding doesn’t change the hash.

BTW: I don’t recall seeing any DKIM setup howto mentioning that you should disable 8bit encoding…

References:

https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
RFC 4871 - “DomainKeys Identified Mail (DKIM) Signatures”
RFC 4871 Section 5.3 - the section about body encodings.

Debugging Ada exceptions

Thu, 14 May 2026 17:49:50 +0000

Each time i have to code in Ada i just hate the language… it makes “clean” coding a pain in the ass (easy workarounds would include using pointers everywhere).

This time i need to use protected objects; protected objects have some associated code blocks (entries, procedures and functions), which can access the private data part; but only one thread can enter such block for one object at a time.
But all these entry points are public to everyone who sees the protected type; you can’t have private entry points which would be only accessible from your internal package.
So i ended up hiding the protected type in the private part of my package, and using a private record as wrapper around it… (i need this to get a pointer to the protected object too; i can’t get a pointer to the protected object in the entry points - there is no “this” or “self” variable).

The real fun started when I ran my test program and it crashed; it would show me the exception cause, but not the location and no backtrace. Attaching with gdb didn’t help either; there is no automatic breakpoint on unhandled exceptions, and the program doesn’t call abort() (which gdb would break on, and i think this is the way C++ handles it).
Google came up with various different methods to break on unhandled exceptions in ada; only one was a recognized command:

```console linenums=1 $ gdb ./main […] (gdb) catch exception unhandled Unable to insert catchpoint. Try to start the program first. (gdb) start Temporary breakpoint 1 at 0x416d9e: file …/main.adb, line 53. Starting program: …/main [Thread debugging using libthread_db enabled]

Temporary breakpoint 1, main () at ..../main.adb:53 53 Test; (gdb) catch exception unhandled Cannot insert catchpoints in this configuration.

And it didn't work. I searched for the gdb code, and found this (<http://gcc.gnu.org/bugzilla/attachment.cgi?id=21797>):  ```c static const struct exception_support_info default_exception_support_info = {  "__gnat_debug_raise_exception",  "__gnat_unhandled_exception",  "__gnat_debug_raise_assert_failure",  ada_unhandled_exception_name_addr }; static const struct exception_support_info exception_support_info_fallback = {  "__gnat_raise_nodefer_with_msg",  "__gnat_unhandled_exception",  "system__assertions__raise_assert_failure",  ada_unhandled_exception_name_addr_from_raise };

So i just tried:

console linenums=14 (gdb) break __gnat_unhandled_exception Breakpoint 2 at 0x7ffff78bdb1e (gdb) continue [...]

It breaks on the next unhandled exception, showing a useful backtrace and so on. (On my system the second set of function names was the “good” one - break on __gnat_raise_nodefer_with_msg to see all exceptions, break on system__assertions__raise_assert_failure to see all failed asserts).

PS: To get useful backtraces (i.e. including formal parameters and local values) you have to disable optimisations; gdb can not track the value of variables if they are only stored in registers.

GNAT BUG on access procedure parameter in protected type entry

Thu, 14 May 2026 17:49:50 +0000

I already mentioned that i don’t like Ada, but I didn’t expect to hit something like this:

$ gnatmake gnatbug gcc-4.4 -c gnatbug.adb +===========================GNAT BUG DETECTED==============================+ | 4.4.6 (x86_64-pc-linux-gnu) Assert_Failure sem_ch3.adb:1063 | | Error detected at gnatbug.adb:3:17 | | Please submit a bug report; see http://gcc.gnu.org/bugs.html. | | Use a subject line meaningful to you and us to track the bug. | | Include the entire contents of this bug box in the report. | | Include the exact gcc-4.4 or gnatmake command that you entered. | | Also include sources listed below in gnatchop format | | (concatenated together with no headers between files). | +==========================================================================+  Please include these source files with error report Note that list may not be accurate in some cases, so please double check that the problem can still be reproduced with the set of files listed.  gnatbug.adb gnatbug.ads  compilation abandoned gnatmake: "gnatbug.adb" compilation error

So GNAT doesn’t like “access procedure” parameters in entries for protected types. As I’m hiding the protected types anyway and there is no need to protect the object while running the callback I was able to workaround it: calling the entry, then the callback, and then a cleanup procedure…

Here the simplified testcase sources, which I also provided to the upstream bug: Bug 49164 - GNAT BUG on access procedure parameter in protected type entry

```ada linenums=1 title=”gnatbug.ads” package Gnatbug is protected type X is entry Foo (Bar : access procedure); private Member : Integer := 0; end X; end Gnatbug;

```ada linenums=1 title="gnatbug.adb" package body Gnatbug is  protected body X is  entry Foo (Bar : access procedure)  when Member = 0 is  begin  Bar.all;  end;  end X; end Gnatbug;

Exporting redmine wiki pages

Thu, 14 May 2026 17:49:50 +0000

I wanted to export all wiki pages of a redmine project as plain text (the original textile code) with a small yaml header:

~/redmine $ RAILS_ENV=production ./script/console -s Loading production environment in sandbox (Rails 2.3.11) Any modifications you make will be rolled back on exit NOTE: SourceIndex.new(hash) is deprecated; From /usr/lib/ruby/gems/1.8/gems/rails-2.3.11/lib/rails/vendor_gem_source_index.rb:100:in `new'. >> def export_text(p) >> c = p.content_for_version(nil) >> "---\ntitle: #{p.title}\nupdated_on: #{c.updated_on}\n---\n\n#{c.text}" >> end => nil >> def export_wiki(dir, wiki) >> dir = dir + "/" + wiki.project.identifier >> Dir.mkdir(dir) >> wiki.pages.each { |p|File.open(dir + "/" + p.title + ".textile", "w") { |f| f.write(export_text(p)) } } >> true >> end => nil >> Project.all => [#<Project id: 2, name: "Debian Server", ... , identifier: "debianserver", ... >> export_wiki("/tmp", Project.find(2).wiki) => true

Now /tmp/debianserver/ contains all the wiki pages.

The ruby functions without irb shell:

def export_text(p)  c = p.content_for_version(nil)  "---\ntitle: #{p.title}\nupdated_on: #{c.updated_on}\n---\n\n#{c.text}" end  def export_wiki(dir, wiki)  dir = dir + "/" + wiki.project.identifier  Dir.mkdir(dir)  wiki.pages.each { |p|File.open(dir + "/" + p.title + ".textile", "w") { |f| f.write(export_text(p)) } }  true end

Flash sound issues with 64-bit linux

Thu, 14 May 2026 17:49:50 +0000

A glibc change committed one year ago (Improve 64bit memcpy/memmove for Atom, Core 2 and Core i7), which already resulted in some ~~flamewars~~ discussions (involving Linus Torvalds vs. Ulrich Drepper), broke some applications which used memcpy when they should have used memmove (only the latter handles overlapping memory areas).

Many applications have probably been fixed, but Adobe never took their 64-bit linux flash player very serious. So if your flash player has a very strange sound output, you can try to preload a wrapper libary which replaces memcpy with memmove.

Debian includes such wrapper in the 64-bit libc6 package (for details read /usr/share/doc/libc6/NEWS.Debian.gz), just check whether you have the file /usr/lib/x86_64-linux-gnu/libc/memcpy-preload.so.

If you do, just run something like this:

$ cat >> /etc/ld.so.preload /usr/lib/x86_64-linux-gnu/libc/memcpy-preload.so <ctrl-d>

And all (64 bit) applications on your system will use memmove - and this fixed the sound issues for me :)

Another way to fix it is to use nspluginwrapper and the 32-bit flash player.

openSUSE Build Service

Thu, 14 May 2026 17:49:50 +0000

Why you want packages instead of building software yourself¶

Open source projects often have more or less simple instructions to build their software. Sometimes this can be the right thing to use, but often you want a better integration into your system; for example init scripts, logrotate configs, config files, … Using packages also provides an easy way to get rid of the software again (some projects provide a “make uninstall”, but it often doesn’t work reliable).

Especially when your distribution already provides a package, and you just want a newer release than what your distribution provides, building it yourself leads to more problems:

if you install it in the same place like the still installed package, you get an ugly mix of new and old files (the new install perhaps doesn’t provide all files the old package did); and if you decide to remove the package later (“I build it myself, don’t need the package anymore”), it obviously breaks.
if you install it in a different place (/usr/local instead of /usr for example), you get funny path conflicts - /usr/local/bin isn’t always in your PATH, but if it is, it is probably before /usr/bin; so depending on the context you will either use the old or the new binaries (“I installed the new release, but it still misses the feature”).
for (shared) libraries installing without a package is suicide, as you need the package manager to track dependencies (and conflicts).

So you basically shouldn’t install software without a package manager.

If your distribution already provides a package, updating the package to a newer release might be easy, the package systems often try to keep the original source and their modifications to it separated in some way, so you only have to check whether those modifications still work with the new release, and perhaps update the dependencies.

Why providing packages isn’t wasn’t easy¶

Obviously building packages still isn’t easy for most users, so it is obvious that you want the upstream developers to provide packages for their latest releases (the maintainers of your distribution won’t have the time to track all the upstream projects, and perhaps your distribution doesn’t even provide a package at all).

But providing packages for many distributions is time-consuming; you need to build the package on every distribution, and therefore have to maintain a install of it somewhere (probably in a vm).
Often different releases of a distribution need different handling in the details, perhaps have different names for dependencies or the build software providing more or less features.

In debian, the core build helpers are dpkg-dev and debhelper. Many packages require now debhelper >= 8, but older releases only have older versions. So now you need to install a new debhelper, which in turn requires perl 5.10 - which isn’t available in ubuntu hardy (still LTS for server).

You probable see now why most open source projects either provide no packages or only packages for a small number of dists (probably the ones they are using on their own systems).

The solution¶

https://build.opensuse.org/ (OBS) - while the url might look like they only support openSUSE, they actually support building rpm and deb packages for many distributions.

From time to time we discussed the problem with the debhelper versions; I failed backporting it on launchpad some years ago. darix finally tried it and got debhelper 8.1.6~bpo60+1 packages for Ubuntu 9.10, 10.04, 10.10 and 11.04. They didn’t need any other dependencies, so it wasn’t that hard :)
Now I finally got the Ubuntu 8.04 (hardy, LTS server) backport for debhelper and dpgk (and po4a) working, with some more or less ugly hacks in debhelper to get it working with perl 5.8.

Now I can use the same source package for all debian distributions, and still use the features from the current debhelper (as many packages in debian do, so it is easy to update a debian package to a newer version and build it in OBS).

Configure a project to build packages for Ubuntu hardy with backported debhelper:

<repository name="xUbuntu_8.04">  <path project="Ubuntu:backport-overlay" repository="xUbuntu_8.04"/>  <path project="Ubuntu:8.04" repository="standard"/>  <arch>x86_64</arch>  <arch>i586</arch> </repository>

Similar for other Ubuntu versions (you can omit the second path line, as is included by the overlay too)

You can see some examples of this in the server:http project; as the Ubuntu projects in OBS don’t include universe and multiverse packages, there are still some dependencies missing. But you could always just copy the source packages from ubuntu to the project and build them again (see home:stbuehler/lighttpd).

PS: You might ask now why I’m not using launchpad. As a matter of fact I did (my ppas are still available, but not updated anymore). launchpad sucks, as I had to upload different packages for the different releases; the changelog has to specifiy the target release. So I wrote a shell script that would build different source packages with the needed changelog entries and so on… this just sucks. And of course it only builds ubuntu packages - with OBS I have “all” packages in one place (“all” as in “all I care about”).

References:

Greatest common divisor and Fibonacci numbers

Thu, 14 May 2026 17:49:50 +0000

Many people know a very basic fact about Fibonacci numbers:

\[ gcd(F_n, F_{n+1}) = 1 \]

In other words: $F_n$ and $F_{n+1}$ are coprime

There is a more generic form:

\[ gcd(F_n, F_m) = F_{gcd(n, m)} \]

The first proposition follows from this, as $gcd(n, n+1) = 1$.

Some time ago Johannes and I discovered another fact if n is coprime to 2 and 3:

\[ n \bmod{6} \in \{ 1, 5 \} \Rightarrow gcd(F_n, F_{n-1} + 1) = gcd(F_n, F_{n-1} - 1) = 1 \]

Proofing it wasn’t very difficult; just use the identity $gcd(a, b) = gcd(a, b - a)$ to show the following:

\[ gcd(F_n, F_{n-1} + 1) = gcd(F_{n-2k} - F_{2k}, F_{n-(2k+1)} + F_{2k+1}) \]

\[ gcd(F_n, F_{n-1} - 1) = gcd(F_{n-2k} + F_{2k}, F_{n-(2k+1)} - F_{2k+1}) \]

Depending on the value of $n \bmod{4}$ (only 2 possibilites: 1 and 3) you can choose a value for k which helps to easily simplify at least one sum or difference with the basic identity of the Fibonacci numbers $F_{n+2} = F_{n+1} + F_n$.

Comparing the first element of an enum and a pointer

Thu, 14 May 2026 17:49:50 +0000

I just had a very stupid bug in a lighttpd2 feature I was working on, it looked like this:

```c linenums=1 typedef enum { S_DEAD, S_START / … / } con_state;

typedef struct { con_state state; / … / } con;

void foo(con c) { if (S_DEAD == c) { / … */ } }

I obviously wanted to check `c->state`, not `c` - and I didn't even get a warning from my compiler (neither gcc nor clang). Comparing with `S_START` resulted in this compiler warning:  ```console [...] warning: comparison between pointer and integer [enabled by default]

My guess is that it doesn’t warn when you compare pointers with 0, and S_DEAD as the first value in the enum corresponds to the number 0. Comparing with S_START is similar to comparing with 1.

It should still print a warning of course - an enum member is obviously not a pointer.

Hidden Finalizers in Ada

Thu, 14 May 2026 17:49:50 +0000

It’s not a bug, it’s a feature!

Often you want to execute specific code when a object is destroyed - for example free all pointers in it. In Ada you need the Ada.Finalization package for this, which provides you with the Controlled and the Limited_Controlled tagged types; they allow custom action for Initialize, Adjust (not for limited) and Finalize.

Example:

```ada linenums=1 title=”example.adb” with Ada.Finalization; with Ada.Unchecked_Deallocation;

procedure Example is package X is type Container is limited private; – limited, so you don’t accidentally copy a container

private type Tree; type Tree_Access is access Tree; type Tree is null record; – this obviously needs more details :)

 type Container is new Ada.Finalization.Limited_Controlled with record Root : Tree_Access; end record; overriding procedure Initialize (C : in out Container); overriding procedure Finalize (C : in out Container);

end X;

package body X is procedure Initialize (C : in out Container) is begin C.Root := null; end Initialize;

 procedure Finalize (C : in out Container) is procedure Free is new Ada.Unchecked_Deallocation (Tree, Tree_Access); begin Free (C.Root); end Finalize;

end X; begin null; end Example; This solution has a drawback: `Container` becomes a [tagged type](https://www.adaic.org/resources/add_content/standards/05rm/html/RM-3-9.html) (you could say tagged types are the object-orientation in Ada), but you only see the negative effects on the outside: you can't use methods that dispatch in one more than one tagged type like this:ada linenums=1 title=”example.adb” procedure Example is package X is type A is tagged null record; type B is tagged null record; procedure Foo (x : in out A; y : in out B); end X; package body X is procedure Foo (x : in out A; y : in out B) is begin null; end; end X; begin null; end Example; ```

results in:

$ gnatmake example.adb gcc-4.4 -c example.adb example.adb:6:17: operation can be dispatching in only one type gnatmake: "example.adb" compilation error

Now you could for example replace the parameter “B” with “B’Class” in Foo; it then would only dispatch in x, not in y. But as the taggedness is private in the Container example above (and there is no reason to make it public), you cannot use Container'Class outside the private part of the package.

The solution is mix-in I found in a forum:

```ada linenums=1 title=”example.adb” with Ada.Finalization; with Ada.Unchecked_Deallocation;

procedure Example is package X is type Container is limited private;

private type Tree; type Tree_Access is access Tree; type Tree is null record; – this obviously needs more details :)

 type Container_Control (Enclosing : access Container) is new Ada.Finalization.Limited_Controlled with null record; type Container is limited record Root : Tree_Access; Control : Container_Control (Container'Access); end record; overriding procedure Initialize (C : in out Container_Control); overriding procedure Finalize (C : in out Container_Control);

end X;

package body X is procedure Initialize (C : in out Container_Control) is begin C.Enclosing.all.Root := null; end Initialize;

 procedure Finalize (C : in out Container_Control) is procedure Free is new Ada.Unchecked_Deallocation (Tree, Tree_Access); begin Free (C.Enclosing.all.Root); end Finalize;

end X; begin null; end Example; ```

The access discriminant Enclosing and Container'Access is a hack with a special syntax; I couldn’t find it in the Ada reference manual, but wikibooks knows it too and explains why this only works for limited types too (and more).

References¶

Cross compile Windows Applications

Thu, 14 May 2026 17:49:50 +0000

There is a nice repository on build.opensuse.org which provides some useful packages to cross compile from linux, and I’m going to describe a simple setup using cmake and Qt:

First install openSUSE 12.1 into a virtual machine (unless you want to do it on a real machine).

Then add the extra repositories and install the needed packages (as root):

zypper ar https://download.opensuse.org/repositories/windows:/mingw:/win32/openSUSE_12.1/windows:mingw:win32.repo zypper install mingw32-cross-gcc mingw32-cross-gcc-c++ mingw32-libjpeg-devel mingw32-libpng-devel mingw32-libqt4 mingw32-libqt4-devel mingw32-libtiff-devel mingw32-zlib-devel zypper ar https://download.opensuse.org/repositories/devel:/tools:/building/openSUSE_12.1/devel:tools:building.repo zypper install cmake-2.8.7 binutils git

The second repository is needed for an updated cmake-2.8.7 which includes https://cmake.org/gitweb?p=cmake.git;a=commitdiff;h=6ddb1e5b9a3eff941ad12d29609839871fe518ed
binutils includes “strings” which is needed in one of the scripts below.

Then login with your normal user, and prepare the cmake toolchain file:

~/toolchain-windows.cmake
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16	SET(CMAKE_SYSTEM_NAME Windows) SET(CMAKE_C_COMPILER i686-w64-mingw32-gcc) SET(CMAKE_CXX_COMPILER i686-w64-mingw32-g++) SET(CMAKE_RC_COMPILER i686-w64-mingw32-windres) SET(CMAKE_FIND_ROOT_PATH /usr/i686-w64-mingw32/sys-root/mingw) SET(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) SET(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) SET(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) SET(QT_QMAKE_EXECUTABLE /usr/i686-w64-mingw32/bin/qmake CACHE INTERNAL "" FORCE) SET(QT_MOC_EXECUTABLE /usr/i686-w64-mingw32/bin/moc CACHE INTERNAL "" FORCE) SET(QT_RCC_EXECUTABLE /usr/i686-w64-mingw32/bin/rcc CACHE INTERNAL "" FORCE) SET(QT_UIC_EXECUTABLE /usr/i686-w64-mingw32/bin/uic CACHE INTERNAL "" FORCE)

~/toolchain-windows.cmake

 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16

SET(CMAKE_SYSTEM_NAME Windows)  SET(CMAKE_C_COMPILER i686-w64-mingw32-gcc) SET(CMAKE_CXX_COMPILER i686-w64-mingw32-g++) SET(CMAKE_RC_COMPILER i686-w64-mingw32-windres)  SET(CMAKE_FIND_ROOT_PATH /usr/i686-w64-mingw32/sys-root/mingw)  SET(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) SET(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) SET(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)  SET(QT_QMAKE_EXECUTABLE /usr/i686-w64-mingw32/bin/qmake CACHE INTERNAL "" FORCE) SET(QT_MOC_EXECUTABLE /usr/i686-w64-mingw32/bin/moc CACHE INTERNAL "" FORCE) SET(QT_RCC_EXECUTABLE /usr/i686-w64-mingw32/bin/rcc CACHE INTERNAL "" FORCE) SET(QT_UIC_EXECUTABLE /usr/i686-w64-mingw32/bin/uic CACHE INTERNAL "" FORCE)

Now checkout your favorite project which uses cmake+qt and build it with cmake in a subdirectory:

git clone -b stefan-wip https://git.stbuehler.de/stbuehler/qcross.git cd qcross mkdir winbuild cd winbuild cmake -DCMAKE_TOOLCHAIN_FILE=~/toolchain-windows.cmake .. make ````  The resulting binaries will need some DLLs; with the two scripts below (`chmod +x`) they should be easy to install into a directory:  ```console $ installapp ~/qcross/winbuild ~/app/qcross

Now all the needed files should be in ~/app/qcross.

bin/installexe
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42	#!/bin/bash if [ -z "$1" -o -z "$2" ]; then echo "Syntax: $0 <source> <targetdir> [optionall dll dirs]" 1>&2 exit 1 fi SOURCE=$1 shift TARGET=$1 shift DLLSOURCE=/usr/i686-w64-mingw32/sys-root/mingw/ if [ ! -f "$SOURCE" ]; then echo "source '$SOURCE' doesn't exist" fi mkdir -p "$TARGET" walk() { b="$(basename $1)" d="$TARGET/$b" if [ -f "$d" -a ! "$d" -ot "$1" ]; then echo "Skipping '$b' [current version already present]" else echo "Installing '$b'" cp -a "$1" "$TARGET/" # Hack to find dependencies strings "$1" \| grep '\.dll' \| while read dll do DLL=`find "$DLLSOURCE" "$@" -name "$dll" -print -quit` if [ ! -z "$DLL" -a -f "$DLL" ]; then walk "$DLL" fi done fi } walk "$SOURCE" exit 0

bin/installexe

 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

#!/bin/bash  if [ -z "$1" -o -z "$2" ]; then  echo "Syntax: $0 <source> <targetdir> [optionall dll dirs]" 1>&2  exit 1 fi  SOURCE=$1 shift TARGET=$1 shift  DLLSOURCE=/usr/i686-w64-mingw32/sys-root/mingw/  if [ ! -f "$SOURCE" ]; then  echo "source '$SOURCE' doesn't exist" fi  mkdir -p "$TARGET"  walk() {  b="$(basename $1)"  d="$TARGET/$b"  if [ -f "$d" -a ! "$d" -ot "$1" ]; then  echo "Skipping '$b' [current version already present]"  else  echo "Installing '$b'"  cp -a "$1" "$TARGET/"   # Hack to find dependencies  strings "$1" | grep '\.dll' | while read dll  do  DLL=`find "$DLLSOURCE" "$@" -name "$dll" -print -quit`  if [ ! -z "$DLL" -a -f "$DLL" ]; then  walk "$DLL"  fi  done  fi }  walk "$SOURCE" exit 0

bin/installapp
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16	`#!/bin/bash if [ -z "$1" -o -z "$2" ]; then echo "Syntax: $0 <sourcedir> <targetdir>" 1>&2 exit 1 fi SOURCE=$1 shift TARGET=$1 shift for exe in $(find "$SOURCE" -name '*.exe' \| grep -v CMakeFiles); do echo "Installing executable $exe -> $TARGET" installexe "$exe" "$TARGET" "$TARGET" "$@" done`

bin/installapp

 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16

#!/bin/bash  if [ -z "$1" -o -z "$2" ]; then  echo "Syntax: $0 <sourcedir> <targetdir>" 1>&2  exit 1 fi  SOURCE=$1 shift TARGET=$1 shift  for exe in $(find "$SOURCE" -name '*.exe' | grep -v CMakeFiles); do  echo "Installing executable $exe -> $TARGET"  installexe "$exe" "$TARGET" "$TARGET" "$@" done

Checking SSL Certificates

Thu, 14 May 2026 17:49:50 +0000

Verify whether a certificate matches a private key and has valid timestamp¶

The certificate is the signed public key (and some meta data); to verify whether a certificate matches the private key, one has to extract the public key of both and compare them.

Both the rsa and the x509 subcommand of openssl have a -modulus option to extract the modulus; they can also extract the complete public key, but the option has a different name for each of the subcommands:

openssl x509 -in "$CRT" -noout -pubkey openssl rsa -in "$KEY" -pubout 2>/dev/null

The timestamps are in the text output of the certificate in the fields “Not Before:” and “Not After :”:

openssl x509 -in "$CRT" -text -noout | \ awk -- 'BEGIN {FS=": ";b="";e=""} /^ *Not Before *: / { b = $2 } /^ *Not After *: / { e = $2 } END { print b; print e }

You can convert those timestamps to “seconds since 1970-01-01 00:00:00 UTC” width date +%s, making it easy to compare them to the current date (in the same format).

All in one script (you have to set KEY and CRT before; you probably may want to check whether the files exist too):

 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21

A=$(openssl x509 -in "$CRT" -noout -pubkey) B=$(openssl rsa -in "$KEY" -pubout 2>/dev/null) if [ "$A" != "$B" ]; then  echo "cert doesn't match private key" >&2  printf "$CRT pubkey:\n%s\n$KEY pubkey:\n%s\n" "$A" "$B" >&2 else  DATES=$(openssl x509 -in "$CRT" -text -noout |  awk -- 'BEGIN {FS=": ";b="";e=""} /^ *Not Before *: / { b = $2 } /^ *Not After *: / { e = $2 } END { print b; print e }')  begin=$(echo "$DATES" | head -n1)  end=$(echo "$DATES" | tail -n1)  ubegin=$(date -d "$begin" +%s)  uend=$(date -d "$end" +%s)  unow=$(date +%s)  if [ $unow -lt $ubegin -o $uend -lt $unow ]; then  echo "Invalid timestamps for $CRT, was valid for:" >&2  echo "$DATES" >&2  else  echo "Valid timestamps for $CRT (which matches privkey):"  echo "$DATES"  fi fi

Fix ssh command quoting

Thu, 14 May 2026 17:49:50 +0000

SSH only takes a simple string as command to send to the remote end ¹. In other words, ssh has to concatenate all arguments with a space as separator.

Example:

$ ssh stbuehler.de echo Hello World Hello World

In this case, my local ssh program gets the command ['echo', 'Hello', 'World'] from the system, build the command string 'echo Hello World' from, sends it to my server, and the ssh process there will give this command string to the shell, which will expand it into the 3 separate parts again.

You can see the command string if you give ssh the -v option and have a look for the line with debug1: Sending command:.

If I run the “same” command on my local system, I get the same output:

$ echo Hello World Hello World

Now lets try something else:

$ ssh stbuehler.de 'echo Hello World' Hello World

$ 'echo Hello World' bash: echo Hello World: command not found

What did happen now?
With ssh, my local ssh program got ['echo Hello World'] - but the command it sent was the same, so the server printed the same line as before.

But my local shell still sees the quotes around, and won’t split it - that is what quotes are for.

This behaviour allows tricks like this one:

$ ssh stbuehler.de 'echo *' [list of the (visible) files in the home directory on the server]

On my local system '*' won’t get expanded as it is quoted, but the remote end doesn’t have the quotes anymore, and the shell will expand it.

So what is the problem?

$ printf '%-10s %s\n' Hello World Hello World

printf is a nice tool to output stuff in a formatted way. Now lets try that with ssh:

$ ssh stbuehler.de printf '%-10s %s\n' Hello World; echo X %sn Hello World X

I added the echo X so you can see that my server didn’t even print a newline.

This is not what I wanted to see though - how did this happen?

$ ssh -v stbuehler.de printf '%-10s %s\n' Hello World [...] debug1: Sending command: printf %-10s %s\\n Hello World [...] $ printf %-10s %s\\n Hello World; echo X %s\n Hello World X

As it looses the quotes around my arguments (which contained spaces), it breaks the first argument up, which leads to a completely different result.

I think this is a bug - you would expect that a command with ssh works the same way as it does local. For this the command should have been designed as a list of strings in the SSH Protocol. Nobody will fix this now ofcourse, so we will have to work around that.

Someone else had the same problem over at https://stackoverflow.com/questions/6592376/prevent-ssh-from-breaking-up-shell-script-parameters, and the answers show how to workaround it. But I wanted a new “ssh” program, that would fix this for me. I named it sshsystem, and it works:

$ sshsystem stbuehler.de printf '%-10s %s\n' Hello World Hello World

Yes!

Other fun you can have:

$ ssh stbuehler.de echo Foo ';' echo Bar Foo Bar $ ssh stbuehler.de echo Foo $'\n' echo Bar Foo Bar $ sshsystem stbuehler.de echo Foo $'\n' echo Bar Foo   echo Bar

(The shell on the other side can execute more than one command - either split them with ; or \n - quoted ofc, otherwise your local shell will interpret them)

Source is available at https://gist.github.com/4672115, https://stackoverflow.com/questions/6592376/prevent-ssh-from-breaking-up-shell-script-parameters/14601289#14601289 and below.

sshsystem
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61	#!/bin/bash # quote command in ssh call to prevent remote side from expanding any arguments # uses bash printf %q for quoting - no idea how compatible this is with other shells. # http://stackoverflow.com/questions/6592376/prevent-ssh-from-breaking-up-shell-script-parameters sshargs=() while (( $# > 0 )); do case "$1" in -[1246AaCfgKkMNnqsTtVvXxYy]) # simple argument sshargs+=("$1") shift ;; -[bcDeFIiJLlmOopRSWw]) # argument with parameter sshargs+=("$1") shift if (( $# == 0 )); then echo "missing second part of long argument" >&2 exit 99 fi sshargs+=("$1") shift ;; -[bcDeFIiJLlmOopRSWw]) # argument with parameter appended without space sshargs+=("$1") shift ;; --) # end of arguments sshargs+=("$1") shift break ;; -) echo "unrecognized argument: '$1'" >&2 exit 99 ;; *) # end of arguments break ;; esac done # user@host sshargs+=("$1") shift # command - quote if (( $# > 0 )); then # no need to handle passed command as an array - ssh will merge it anyway. # use bash @Q parameter transformation to quote $@: sshargs+=("${@@Q}") fi exec ssh "${sshargs[@]}"

sshsystem

 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61

#!/bin/bash  # quote command in ssh call to prevent remote side from expanding any arguments # uses bash printf %q for quoting - no idea how compatible this is with other shells. # http://stackoverflow.com/questions/6592376/prevent-ssh-from-breaking-up-shell-script-parameters  sshargs=()  while (( $# > 0 )); do  case "$1" in  -[1246AaCfgKkMNnqsTtVvXxYy])  # simple argument  sshargs+=("$1")  shift  ;;  -[bcDeFIiJLlmOopRSWw])  # argument with parameter  sshargs+=("$1")  shift  if (( $# == 0 )); then  echo "missing second part of long argument" >&2  exit 99  fi  sshargs+=("$1")  shift  ;;  -[bcDeFIiJLlmOopRSWw]*)  # argument with parameter appended without space  sshargs+=("$1")  shift  ;;  --)  # end of arguments  sshargs+=("$1")  shift  break  ;;  -*)  echo "unrecognized argument: '$1'" >&2  exit 99  ;;  *)  # end of arguments  break  ;;  esac done   # user@host sshargs+=("$1") shift  # command - quote if (( $# > 0 )); then  # no need to handle passed command as an array - ssh will merge it anyway.  # use bash @Q parameter transformation to quote $@:  sshargs+=("${@@Q}") fi  exec ssh "${sshargs[@]}"

The Secure Shell (SSH) Connection Protocol, Starting a Shell or a Command ↩

Some notes on SHA-3

Thu, 14 May 2026 17:49:50 +0000

What is SHA-3?¶

SHA-3 is a family of cryptographic hash functions (also see SHA-3 on Wikipedia). NIST selected Keccak as implementation for SHA-3 in October 2012, and released a draft specifying the details in April 2014. I think the algorithm details are final.

How does it work?¶

Keccak consists of two components:

Permutation functions Keccak-f for specific state sizes (1600, 800, 400, 200, 100, 50 and 25 bits); for SHA-3 only Keccak-f[1600] is actually used.
A “sponge” construction: a sponge requires a transformation function (like Keccak-f[1600]) and a capacity parameter.

The sponge maintains a state (as large as the transformation function handles and initialized to zero); the state is divided into a “rate” and a “capacity” part; the rate size is state size - capacity.

Each input and output block is of rate size; when a block comes in it is bitwise XORed into the “rate” part of the state, and then the transformation is run (this is called “absorbing” a block). To output a block the “rate” part is simply copied into the output block (“squeezing”), followed by a transformation run on the state.

As the input data is usually not aligned to the block size, it is always padded by appending a 1 bit, then 0 bits until the next block is full but for one bit, and a final 1 bit again, leading to a minimum padding of two bits ("11") and a maximum of (rate + 1) bits; this padding is named pad10*1.

To generate output of a certain length one just squeezes blocks until the length is reached and truncates if necessary.

This results in the basic Keccak primitive for a capacity of c bits and a certain output length:

Keccak[c](msg, output length) := Sponge[Keccak-f[1600], c](pad10*1(msg), output length)

The output length could be “infinite”, resulting in an endless bit stream (for use in a stream cipher or as PRNG).

Security¶

An algorithm is said to provide n bits of security (for a specific property) if an attack requires 2^n steps (i.e. requires bruteforcing n bits).

To provide n bits of security (preimage, second preimage and collision) with a sponge construction (assuming the transformation function is secure) the capacity has to be 2*n bits, and the output has to be of length 2*n bits. If the output is only n bits, preimage and second preimage are still n bit secure, but collision security drops to n/2 bits (“birthday paradox”).

# || denotes concatenation of bit strings SHA3-224(msg) := Keccak[448](msg || 01, 224) SHA3-256(msg) := Keccak[512](msg || 01, 256) SHA3-384(msg) := Keccak[768](msg || 01, 384) SHA3-512(msg) := Keccak[1024](msg || 01, 512) SHAKE128(msg, output length) := Keccak[256](msg || 1111, output length) SHAKE256(msg, output length) := Keccak[512](msg || 1111, output length)

All functions use a capacity for a security of n bits, where n is the number in the function name. However the output length of the SHA3-n functions is only n bits, restricting collision resistance to n/2 bits - there is no way around this, as the SHA3-n functions are intended to be used as replacements for the SHA-n functions from the SHA-2 family.

The different suffixes appended to the message before padding are used to distinguish different uses of the same Keccak[c] function (domain separation): the suffix "01" represents the domain of SHA3-n functions which take a simple message. The suffix "11" represents the SHAKE functions which take a Sakura padded message; in Sakura the suffix "11" represents a single message (Sakura also supports tree hashing).

Possible NIST manipulations / History¶

The original Keccak submission used the same capacity for the SHA3-n functions as are now in the draft. For the variable output length function it used a capacity of 576 bits, leading to a rate of 1024 bits. Also the suffixes were not part of the proposal.

In 2013 NIST proposed to use capacity 256 for SHA3-224, SHA3-256 and SHAKE256, and capacity 512 for SHA3-384, SHA-512 and SHAKE512.

While the parameter selection itself would have been more consistent (the proposed SHA3-512(msg) := Keccak[512](msg, 512) would have been 256-bit secure against everything), this would have reduced preimage and second preimage resistance below what the corresponding functions in the SHA-2 family provided.

Due to the negative feedback in the crypto community NIST announced in November 2013 to pick the parameters from the original submission, and renamed the SHAKE functions to reflect the bits of security instead of capacity.

So there are two changes remaining since the final submission:¶

The suffixes for domain separation (this was proposed by the Keccak team after the submission, not by NIST itself).
SHAKE256 (512 bit capacity) is a little bit less secure than the original proposed Keccak[] with a capacity of 576; on the other hand most people agree that aiming for more than 256 bit security is pointless.

The Keccak authors wrote:

In the Keccak design philosophy, safety margin comes from the number of rounds in Keccak-f, whereas the security level comes from the selected capacity.

As far as I can see SHA-3 is as trustworthy as the original Keccak submission.

Which SHA-3 hash function to select¶

If you are not bound to be compatible with SHA-2 functions I’d recommend to use SHAKE256 with 512 bits of output to get 256-bit security instead of SHA3-512 - this is nearly twice as fast (rate of 1088 bit vs 576), and more than 256-bit security is just wasting resources.

If you are only interested in 128-bit collision resistance (because you don’t want to “waste” more space storing the output) SHA3-256 is a good choice - SHAKE128 with 256 bits of output is not much faster (rate of 1344 bits vs 1088), but having 256 bit security for preimage could be worth the cost.

Type punning with unions

Thu, 14 May 2026 17:49:50 +0000

TLDR: don’t use unions for type punning; always use memcpy.

Sometimes you might want to reinterpret a value of one type as value of another type. For example you might have an integer parameter, but you know that it actually contains a float value.

Let’s assume the integer was large enough to store the float somehow, and now you want to get the value back. If you follow wikipedia you might do something like this:

float get_float(int i) {  union {  int i;  float f;  } x;  x.i = i;  return x.f; }

Usually this works fine; as long as you access the values directly through the union member probably no compiler will screw this up. (There are various claims whether this is actually supposed to work in different language versions and C vs C++.)

But if you start using pointers (or references in C++) this can fail very fast:

int return0(int *i, float *f) {  *i = 0;  *f = 1;  return *i; }  int test_union_type_punning() {  union {  int i;  float f;  } x;  return return0(&x.i, &x.f); }

If compiled with gcc (4.9.1) gcc -Wall -O2 -S type-punning.c I get this:

return0:  .cfi_startproc  movl $0, (%rdi)  xorl %eax, %eax  movl $0x3f800000, (%rsi)  ret  .cfi_endproc  test_union_type_punning:  .cfi_startproc  xorl %eax, %eax  ret  .cfi_endproc

Although in return0 i and f refer to the same memory location, and the write to f comes after the write to i, the compiler will ignore the write to f. This is called “strict aliasing”; the compiler assumes that a write to a float reference will not modify any integers, and therefore the written integer value is still present.

Even inlining doesn’t help the compiler to see it, and it also doesn’t print a warning.

That is why I always prefer punning with memcpy like this:

#include <string.h>  float get_float(int i) {  float f;  memcpy(&f, &i, sizeof(f));  return f; }

With gcc -Wall -O2 -mtune=ivybridge and clang (same options) both functions generate the same code:

get_float:  .cfi_startproc  movd %edi, %xmm0  ret  .cfi_endproc

So if you have the option avoid unions for type punning. memcpy is safer and makes the intention more clear, and shouldn’t have any performance drawbacks.

References:

systemd: allow normal process to bind to privileged port

Thu, 14 May 2026 17:49:50 +0000

Sometimes services are started by systemd with already dropped privileges, for example inspircd.service starts as irc user.

Such services cannot bind to priliged ports (< 1024) usually - in this case I needed it to listen to port 443 though (additionally to some high port) to allow users behind special firewall configurations to connect to the server.

The solution is to add the following to the service (for example by running systemctl edit inspircd.service):

[Service] AmbientCapabilities=CAP_NET_BIND_SERVICE

debian stretch: upgrade 32-bit to 64-bit

Thu, 14 May 2026 17:49:50 +0000

There are various reasons why one would prefer 64-bit over 32-bit (or not); basically it is about improved ABI (passing arguments in registers), bigger register (can be faster) versus higher memory usage (because pointers are twice as big). In some corner cases you want 64-bit to be able to use more memory in your programs (32-bit kernels can often handle more than 4G memory, but 32-bit userspace programs can’t).

For me 64-bit offers higher security as well: ASLR (address space layout randomization) should be more effective on 64-bit because it can use more entropy.

So that is why I decided to upgrade some 32-bit (called “i386” in debian) machines to 64-bit (“amd64”); after some trial and error I came to the following set of operations to do this in a “reliable” (for me) and fast way.

Note 2020-10-24

crossgrader just made it to debian unstable; it appears to support crossgrading even across CPU-incompatible architectures.

Instructions¶

This one should be obvious: make sure you have backups
If you can’t figure out what one of the commands below does, this is not for you. Expert mode only :)
Don’t blame me if it fails :)
Some programs store data in a platform specific way. So far I had this problem only with postgresql, but other databases are very likely to be affected too. Export the data in a platform independent way before and restore it afterwards.
If you run custom installed stuff like rvm, virtualenv or npm they probably won’t work after the migration.
Remember which packages were installed, so you can later check nothing is missing (and you didn’t install packages you didn’t want). As I use aptitude with “markauto” I also store these states:
```
aptitude search ~M | cut -c5- | cut -d' ' -f1 > aptitude.auto dpkg -l | grep '^ii' | awk '{print $2}' > packages 
```
Check the current architectures. Should show “i386” in the first and either nothing or “amd64” (when multiarch is already enabled) in the second command.
```
dpkg --print-architecture dpkg --print-foreign-architectures 
```
Now upgrade to a 64-bit kernel. Since stretch you already need a multiarch setup for this:
```
dpkg --add-architecture amd64 apt-get update apt-get --no-install-recommends install linux-image-amd64:amd64 
```
If you need dkms modules you also need linux-headers-amd64:amd64. Make sure the dkms modules actually got compiled before rebooting if they are essential.
Reboot and make sure you boot the amd64 kernel - either manipulate your bootloader config before rebooting, select it manually, or remove the 32-bit kernel before.
```
uname -r # should show 4.9.0-3-amd64 
```
Now is a good time to remove special 32-bit only packages, like libc6-xen or the 32-bit kernel.
You’ll see a repeating pattern below, so I’ll explain it first. apt-get (and aptitude) are not good at resolving conflicts, and don’t understand they don’t have to remove the :i386 packages to install the corresponding :amd64 package. So they would start with removing the :i386 packages, which essentially breaks your system, instead of just installing the :amd64 package.

So we only download the packages with apt, and install them manually with dpkg. For this we need a clean /var/cache/apt/archives/ directory.

The pattern is like this:
```
apt-get clean apt-get -y --no-install-recommends --download-only install SOME_PACKAGES dpkg --install /var/cache/apt/archives/*.deb 
```
If the download command shows errors, it usually mentions missing dependencies: just repeat the command and add those at the end of the command.

Sometimes dpkg fails:
- If a Pre-Depends package is missing, it won’t install it at all. At the end dpkg will show you the *.deb filename - just install those again with dpkg --install ....
- If a Depends package is missing it won’t configure the package. Just run dpkg --configure -a afterwards to fix those.
The examples below sometimes anticipate the dpkg failures and show a second command to run.
For whatever fucked up reason the dash preinst script uses bash; and bash of course “Pre-Depends” on dash. There is a good chance this breaks later, and if one of them gets removed you’re in big trouble (xxd -r might help you restoring binaries from another system). So we update these first:
```
apt-get clean apt-get -y --no-install-recommends --download-only install dash:amd64 bash:amd64 dpkg --install /var/cache/apt/archives/*.deb dpkg --install /var/cache/apt/archives/dash_*.deb /var/cache/apt/archives/bash_*.deb 
```
Update

Good news, #604873 (and #866362 with it) got fixed in debian buster, which should make this step unnecessary.

Now we change the host architecture by installing the new packaging tools. This should work without aptitude too if you don’t want it.

apt-get clean apt-get -y --no-install-recommends --download-only install dpkg:amd64 apt:amd64 aptitude:amd64 apt-utils:amd64 dpkg --install /var/cache/apt/archives/*.deb dpkg --install /var/cache/apt/archives/dpkg_*.deb

Check the architecture indeed changed:

dpkg --print-architecture dpkg --print-foreign-architectures

Now install all :i386 with :amd64 as well. You can start with the libraries and perl (this sometimes keeps the failing list shorter, but not always).
```
apt-get clean apt-get --download-only -y --no-install-recommends install `dpkg -l | grep '^.i' | awk '{print $2}' | grep :i386 | sed -e 's/$.*$:i386/\1:i386- \1:amd64/'` dpkg --install /var/cache/apt/archives/lib*.deb /var/cache/apt/archives/perl*.deb dpkg --configure -a 
```
The download command might fail due to missing dependencies (see note above); also packages which are not available on amd64 can’t be installed of course. You could try removing them if they are not strictly needed, or put a | grep -v PKGNAME before sed.

Now install everything else as :amd64.

apt-get clean apt-get --download-only -y --no-install-recommends install `dpkg -l | grep '^.i' | awk '{print $2}' | grep :i386 | sed -e 's/\(.*\):i386/\1:i386- \1:amd64/'` dpkg --install /var/cache/apt/archives/*.deb

Again you might need to fix the download command like before. Instead of redownloading you can just remove the just installed packages too, or just install them again.

This was basically the big step.

Make sure your stuff is working again. The following steps cleanup the 32-bit packages, and for example installing postgresql-9.6:i386 to recover your database becomes more difficult if all dependecies are already gone.
Now remove the :i386 packages - they shouldn’t be needed anymore. I used aptitude for this (limit package view with l, then enter ~ri386). Something like this might work too:
```
apt-get autoremove apt-get remove `dpkg -l | grep '^.i' | awk '{print $2}' | grep :i386` 
```

Restore the aptitude markauto state:

aptitude markauto `cat aptitude.auto | sed -e s/:i386/:amd64/`

Check installed package differences:

diff -u <(sed s/:.*// packages | uniq) <(dpkg -l | grep '^ii' | awk '{print $2}' | sed s/:.*// | uniq) | less

Lines with + are new packages, lines with - are removed packages.

Remove i386 architecture:
```
dpkg --remove-architecture i386 
```
Only works if there are no i386 packages left.
You’re done. Reboot if you want to make sure everything is still working :)

Additional notes¶

Debian multiarch dependency handling¶

Sometimes the dependency handling is fucked up. E.g. postgresql (architecture independent) depends on postgresql-9.6 - it isn’t multiarch enabled as far as I can tell, and this means it wants postgresql-9.6 with the host architecture (which is completely unreasonable as it is just a meta package pulling components).

A similar problem exists the other way too: postgresql-9.6 (architecture dependent) depends on locales (architecture independent). postgresql-9.6 wants locales to be from the same architecture as itself, and apt and dpkg pretend locales is from the host architecture, which doesn’t match if you try to install postgresql-9.6:i386 and the host architecture is already amd64.

I have no solution for the first problem; in the second case just download the package with wget and install it with dpkg --install. It won’t configure it (because a dependency is missing), but it should be usable.

Useful tools¶

needrestart is a great tool to find processes which should be restarted after upgrades - or 32-bit to 64-bit migrations.
etckeeper is a great tool to keep track of your /etc/ changes.

Feedback¶

I received some mails with feedback, thanks Leszek Dubiel and Klemens:

It’s probably a good idea to make sure there are no pending updates before you start.
I pass --no-install-recommends to apt; if you enabled APT::Install-Suggests in your apt config you should add --install-suggests as well in those places, or simply put this into /etc/apt/99-no-auto-install.conf during the procedure:
```
APT::Install-Recommends "false"; APT::Install-Suggests "false"; 
```
You could make sure before starting your packages are in good state, and you don’t have any configured-but-not-installed packages. List the unclean packages with:
```
dpkg -l | grep -v '^ii' 
```
Purge previously installed and still configured packages with (this should remove all configuration and data of those packages - so don’t do this if you still need those):
```
apt-get purge $(dpkg -l | grep "^rc" | awk '{print $2}') 
```
Or with aptitude:
```
aptitude purge '~c' 
```
You can try to make sure before that all the packages you want are available on 64-bit:
```
apt-get --dry-run --download-only -y --no-install-recommends install \  `dpkg -l | grep '^.i' | awk '{print $2}' | grep :i386 | sed -e 's/$.*$:i386/\1:i386- 1\1:amd64/'` 
```
If you have packages that only work in a 32-bit environment you might be able to run them in a multiarch setup afterwards; just be careful when removing 32-bit packages above (either don’t remove them, or reinstall them later).
If dpkg --install fails with “too many errors” you might want to try:
```
dpkg --abort-after=999999 --install ... 
```
Due to my repeated usage of apt-get clean a fast network connection is useful, or a local caching proxy (e.g. squid-deb-proxy; better run it on a second machine though).

Using VRF (Virtual Routing and Forwarding) on Linux

Thu, 14 May 2026 17:49:50 +0000

It isn’t uncommon on linux systems to have muliple (layer 3, i.e. with IP addresses, not counting the loopback device) network interfaces. For example your main interface (with the default route) and a docker bridge. Or you run a firewall between a public network and one or many internal networks (perhaps as tagged VLAN interfaces).

But in rather rare scenarios you need multiple default routes: for example a separate management access in case someone attacks your main interface or it breaks due to other reasons. Or you want to provide a service to different networks (which are not connected directly) from the same host.

In those cases you need to be careful: if you simply add multiple default routes, linux will just pick one and go with it. Back in the old days you had to use policy-based routing for those cases: add another routing table and select it based on the source address for example; the second routing table can have a different default route than your main table.

Example

I have seen enterprise appliances using multiple default routes (and multiple interfaces of course), and they kept wondering why it didn’t work. Well, we use ACLs to make sure systems uses the correct source address to prevent IP address spoofing; even without ACLs we usually enable uRPF. If you really need multiple interfaces, which can be connected to from overlapping sources, you MUST setup policy-based routing (unless the outgoing interface doesn’t matter).

VRFs on linux are mostly a fancy way to setup policy-based routing for such special cases.

Basic idea¶

Make sure your loopback device is up; without it various things just fail: ip link set dev lo up.
For each VRF apart from your default context create a VRF interface with a separate routing table like: ip link add name blue type vrf table 10. You can assign names to those ids in /etc/iproute2/rt_tables or /etc/iproute2/rt_tables.d/*.conf - also handy to see which IDs are already in use by default. Each VRF needs its own table id!
Start VRFs: ip link set dev blue up
Assign interfaces to the VRF and start them: ip link set dev eth0 vrf blue up
Now you can configure addresses with ip address as always; to configure routes you need to specify the VRF like: ip [-6] route ... vrf blue (or the table id with ... table 10).

Sadly there are some cornercases that won’t work properly.

TLDR: run fix-vrf-rules.sh to fix it.

How it works¶

Routing on linux uses rules to find tables, and then looks up the target in the tables.

More precisely: it loops through all rules by preference, and if a rule matches, it will execute its action. If a action doesn’t lead to a final result it will continue with the next rule.

Usually the action is a table lookup; if the lookup finds a matching route, the process ends. In short: first table with a matching entry wins!

You can take a look at the rules with: ip rule (IPv6: ip -6 rule. For everything below keep in mind IPv6 has a separate configuration).

For IPv4 they look like this by default:

0: from all lookup local 32766: from all lookup main 32767: from all lookup default

(In IPv6 the lookup default line is not present by default.)

When you create a VRF (with linux kernel >= 4.8) you get this instead:

0: from all lookup local 1000: from all lookup [l3mdev-table] 32766: from all lookup main 32767: from all lookup default

It inserted a new rule with a rather magic [l3mdev-table] lookup. This will lookup the table you specified on creation of the VRF interface when the packet to be routed uses an interface that belongs to a VRF. Only one rule is needed for all VRFs!

But… sadly the lookup local comes before the VRF lookup; if you try to ping one of your main addresses from the VRF it will find them in the local table, and never reach the VRF routing table. This is almost never what you wanted; with RFC1918 addresses you might want to reach someone else entirely (or just want to take it the proper path due to stateful firewalls: the response won’t take the shortcut!).

The solution is to move the lookup local rule down; even the “selftests” script in the kernel does this:

ip -4 rule add pref 32765 table local ip -4 rule del pref 0 ip -6 rule add pref 32765 table local ip -6 rule del pref 0

The kernel Documentation/networking/vrf.txt also recommends adding unreachable routes to the VRF routing tables so that routes afterwards are taken (I’d recommend using vrf blue instead of table 10 though):

ip -4 route add table 10 unreachable default metric 4278198272 ip -6 route add table 10 unreachable default metric 4278198272

An even easier solution in my opinion is to add another rule with an unreachable target which only triggers in VRF context:

ip -4 rule add pref 2000 l3mdev unreachable

Now the rules should look like this:

1000: from all lookup [l3mdev-table] 2000: from all lookup [l3mdev-table] unreachable 32765: from all lookup local 32766: from all lookup main 32767: from all lookup default

The unreachable action overrides the lookup, but due to l3mdev only triggers if a VRF lookup would have triggered, and solves the problem for all VRFs.

My script fix-vrf-rules.sh should apply those changes in a safe way.

Demo¶

I created another script vrf-demo.sh (requires fix-vrf-rules.sh) to show how a VRF setup can look like.

First it runs in a separate network namespace, so your normal network doesn’t break.

Then it will create a VRF and a veth-link (“virtual ethernet”, consisting of two interfaces) between the VRF and the default environment, setup some addresses and routing and showing connectivity.

Using VRFs¶

Sadly most programs can’t use VRFs directly; they’d need support to set the SO_BINDTODEVICE (or SO_BINDTOIFINDEX) socket option. Without that they will end up using the default VRF (binding sources addresses from other VRFs doesn NOT work).

For incoming TCP connections you should be able to use sysctl -w net.ipv4.tcp_l3mdev_accept=1 to have a TCP server running in the “global” VRF accept connections in other VRFs as well (and the connection then being in the VRF it came from). The kernel also has sysctl options for UDP and RAW sockets, but I can’t see how that’d be useful, as they don’t result in a (VRF specific) connection socket, and response packets wouldn’t be sent in the VRF.

You can change the default VRF for a program with ip vrf exec blue ... - this will install a hook in the kernel to basically set SO_BINDTODEVICE everytime a new socket is created.

Comparing with policy-based routing¶

With the traditional policy-based routing you’d add rules like this:

ip rule add from 192.0.2.2 lookup 40

And then fill the routing table 40.

As binding to source addresses is a platform-independent concept, many programs support it (compared to SO_BINDTODEVICE).

On the other hand you can use the same IP addresses in different VRFs; this is not possible without VRFs (for example you could run a DNS resolver for different networks on the same IP address for easier configuration).